Hacker News new | ask | show | jobs
by packetbeats 4422 days ago
PF_RING is an option but it requires a kernel module and specific network cards. Before then, the memory map sniffing feature of the Linux kernel [1] can improve libpcap performance. Not quite to 10G speeds, though, but I think enough for most cases :-)

[1]: http://www.cs.fsu.edu/~baker/devices/lxr/http/source/linux/D...

1 comments

Any plans to support it? Part of my job (historically) has been building line rate pcap appliances that do pcaps at nanosecond resolution (using endace cards, Mellanox, or solarflare). PF_RING is a bit tricky to get working, but is completely flawless when you get it running.

This software looks fantastic however.